TRW & Co · Technology, Data & IP
Data Protection Solicitors in London
Data protection solicitors London businesses instruct help them collect, share and secure personal data lawfully under the UK GDPR, the Data Protection Act 2018 and PECR. The Data (Use and Access) Act 2025 changed lawful bases, cookies, automated decisions, subject access and complaints in 2026, and the regulator's new powers make getting the detail right more important than ever.
Key pointSince 19 June 2026 every controller must run its own data protection complaints process and acknowledge complaints within 30 days, so your internal records are now the first evidence the regulator will see.
At a glance
Main reforms in force
Most data protection amendments in the Data (Use and Access) Act 2025 took effect on 5 February 2026, with the complaints regime following on 19 June 2026.
Breach reporting window
Notifiable personal data breaches must be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of them.
Higher PECR fines
Fines for cookie and electronic marketing breaches now match UK GDPR levels, up to £17.5 million or 4% of worldwide annual turnover.
New regulator structure
The ICO became the Information Commission on 30 September 2026, a board-led body; existing guidance and enforcement continue under the same ICO name.
EU adequacy renewed
The European Commission renewed the UK adequacy decisions in December 2025, so personal data can continue to flow from the EU to the UK.
Swipe or scroll →
What data protection solicitors London businesses instruct actually do
Data protection solicitors London organisations instruct advise on how personal data is collected, used, shared, secured and deleted, and on what happens when something goes wrong. In England and Wales the core rules sit in the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), now substantially amended by the Data (Use and Access) Act 2025.
The law reaches almost every business. A two-person start-up running a mailing list, a fund administrator holding investor KYC files, a hospital group, a recruitment platform using automated screening and a retailer setting analytics cookies are all processing personal data. The question is rarely whether the law applies; it is how much risk the processing carries and whether the organisation can prove it has managed that risk.
Data protection becomes a pressing legal question at predictable moments: launching a product that profiles customers, buying a company with a large customer database, outsourcing to an overseas processor, receiving a hostile subject access request in the middle of an employment dispute, or discovering a breach on a Friday evening. Each of those moments has a deadline, a regulator and a paper trail.
The legal framework after the Data (Use and Access) Act 2025
The UK GDPR is the retained version of the EU GDPR, read alongside the Data Protection Act 2018, which adds exemptions, special rules for law enforcement and intelligence processing, criminal offences and the enforcement machinery. PECR governs electronic marketing, cookies and similar technologies. The rules apply across the whole of the UK, so Scotland and Northern Ireland follow the same substantive law, although claims are brought in their own courts.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and has been commenced in stages. The main data protection amendments took effect on 5 February 2026 under the Commencement No. 6 Regulations, and the new statutory complaints regime followed on 19 June 2026. Our guide to the Data (Use and Access) Act tracks each stage in detail.
What changed in February 2026
- Recognised legitimate interests. A new list of purposes, such as certain disclosures to public bodies, safeguarding and crime prevention, for which no balancing test is needed.
- Compatible further processing. Clearer rules on when data collected for one purpose can be reused for another.
- Automated decision-making. The old near-prohibition on solely automated significant decisions is replaced by a permission-with-safeguards model, except where special category data is involved.
- Subject access. Controllers need only carry out reasonable and proportionate searches, and the clock can pause while they seek genuinely needed clarification.
- Cookies. Some low-risk storage and access, such as certain analytics and functionality, no longer needs consent if users are told and can object.
- PECR penalties. Fines for marketing and cookie breaches now match UK GDPR levels, up to £17.5 million or 4% of worldwide annual turnover.
- International transfers. A new, more risk-based test for adequacy decisions and for transfers made under appropriate safeguards.
The regulator
The Information Commissioner's Office became the Information Commission on 30 September 2026: a corporate body led by a board rather than a single commissioner. Existing guidance, codes and enforcement action carry over. The regulator also gained stronger investigatory tools, including powers to compel interviews and to require a technical report from an approved person.
| Obligation | Source | Timeline or threshold |
|---|---|---|
| Report a personal data breach to the regulator | UK GDPR Article 33 | Without undue delay and, where feasible, within 72 hours of becoming aware, unless unlikely to result in a risk to individuals |
| Tell affected individuals about a breach | UK GDPR Article 34 | Without undue delay where the breach is likely to result in a high risk |
| Respond to a subject access request | UK GDPR Articles 12 and 15 | One month, extendable by up to two further months for complex or numerous requests |
| Acknowledge a data protection complaint | DPA 2018 as amended (in force 19 June 2026) | Within 30 days of receipt |
| Carry out a DPIA | UK GDPR Article 35 | Before high-risk processing begins |
| Maximum fine (higher tier) | UK GDPR Article 83 and DPA 2018 | £17.5 million or 4% of worldwide annual turnover, whichever is higher |
Key decisions: lawful basis, roles and governance
Most compliance failures trace back to three early decisions that were never written down. Good data protection solicitors London clients rely on will force those decisions into the open before a regulator or claimant does.
Choosing the lawful basis
Consent is often the wrong answer. It must be freely given, specific and withdrawable, which makes it fragile for employee data or core service delivery. Contract, legal obligation and legitimate interests usually fit better, but legitimate interests still needs a documented assessment unless the purpose is now a recognised legitimate interest. Special category data, such as health or biometric data, needs an additional condition under Article 9 and often an appropriate policy document under Schedule 1 to the DPA 2018.
Controller, joint controller or processor
Labels in a contract do not decide the role; the facts do. A supplier that decides why and how data is used is a controller, whatever the services agreement says. Getting this wrong leaves gaps in Article 28 processor terms, privacy notices and breach responsibilities. In outsourcing and SaaS deals we map roles workstream by workstream, as explained in our IT and outsourcing practice.
Governance proportionate to risk
Not every organisation must appoint a data protection officer, but public authorities and businesses whose core activities involve large-scale monitoring or special category data must. Everyone else needs a named owner, a record of processing activities where required, and a programme that produces evidence. Our UK GDPR compliance checklist sets out the baseline.
Regulators rarely fine organisations for having imperfect policies. They fine them for being unable to show that anyone read, tested or followed them.
How a data protection programme or investigation runs
Whether the trigger is a new product, a transaction or a regulator's letter, the work follows a similar arc. The steps below reflect how data protection solicitors London teams typically structure a matter.
- Scope the processing. Identify the data, the people affected, the systems, the suppliers and the countries involved. Interview the business owners, not just IT.
- Map roles and lawful bases. Record who is controller or processor for each activity and the Article 6 (and, where needed, Article 9) basis relied on.
- Assess risk. Run a data protection impact assessment for high-risk processing, including AI, large-scale profiling, monitoring and children's data, and consult the regulator where residual risk remains high.
- Fix the paperwork. Update privacy notices, processor terms, transfer mechanisms, retention schedules and the complaints procedure now required by law.
- Embed controls. Train staff, set access rules, test security and build a breach and subject access playbook with named decision-makers.
- Respond to events. Handle requests, complaints, breaches and regulator correspondence under privilege where possible, keeping a clear decision log.
- Review annually. Re-test after major system changes, acquisitions or new suppliers, and report to the board.
Documents and evidence to assemble
When the regulator opens an inquiry, its first request is almost always for documents. The organisations that fare best can produce them within days. The core set includes:
- A record of processing activities and a data map showing systems, data categories and flows.
- Privacy notices for customers, employees, candidates and website users, with version history.
- Legitimate interests assessments and DPIAs, signed off and dated.
- Processor and data sharing agreements, including Article 28 terms and security schedules.
- Transfer documentation: the International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, and transfer risk assessments.
- Retention schedule and evidence that deletion actually happens.
- Breach log, including incidents judged not reportable, with reasons.
- Subject access and complaints logs showing response times.
- Board papers and training records showing oversight.
Keep a breach log even for incidents you decide not to report. Article 33(5) requires you to document every personal data breach, its effects and the remedial action taken. Reportable breaches go through the regulator's breach reporting service. An empty log in an organisation of any size tells the regulator that incidents are not being spotted, not that none occurred.
Risks and common mistakes
These are the issues that most often turn a manageable problem into enforcement action or a claim. Each is avoidable with early advice from experienced data protection solicitors London teams.
Treating subject access requests as an administrative chore
Subject access requests are frequently used as pre-action disclosure in employment and commercial disputes. Missing the one-month deadline, over-redacting or failing to search obvious sources such as messaging apps invites a complaint and undermines your litigation position. The 2025 reforms help by confirming that searches need only be reasonable and proportionate, but that standard must be applied and recorded, not assumed. Route requests through a trained team, log every step and take advice early where the requester is in dispute with you. Our subject access request guide covers exemptions and redaction.
Relying on consent for cookies and marketing without checking the rules
PECR, not the UK GDPR, decides when you need consent for cookies and electronic marketing. Since February 2026 some analytics and functionality cookies can be used without consent if users are told and can object, but advertising and cross-site tracking still need opt-in consent. The penalty ceiling for PECR breaches is now the same as for the UK GDPR, so a poorly configured consent banner or a purchased marketing list is a genuine financial risk. See our guide to cookies and PECR.
Assuming the processor carries the risk
Outsourcing processing does not outsource accountability. The controller must choose processors that give sufficient guarantees, impose Article 28 terms and check compliance. Many organisations sign the supplier's standard data processing addendum without reading it, leaving them with weak audit rights, vague sub-processor controls and breach notification periods measured in days. When the supplier is breached, the controller still faces the regulator and the affected individuals. Negotiate breach notice periods, cooperation duties and liability caps that reflect the data at stake.
Overlooking transfers hidden in the supply chain
Remote support from an offshore team, a US-hosted CRM or a sub-processor in Asia all involve restricted transfers. Each needs an adequacy decision, an approved safeguard such as the IDTA or UK Addendum, or a narrow exception. The new transfer test introduced in 2026 is more pragmatic, but it still requires a documented assessment. Organisations that cannot say where their data goes cannot show compliance, and buyers in M&A due diligence increasingly price that uncertainty. Our international data transfers guide explains the options.
Underestimating claims by individuals
Individuals can claim compensation for material and non-material damage, including distress, under Article 82 of the UK GDPR and section 168 of the DPA 2018. The Supreme Court in Lloyd v Google [2021] UKSC 50 limited opt-out representative claims for loss of control of data, but group litigation by named claimants continues, often after a publicised breach. Low-value claims can be costly to defend in aggregate. A prompt, well-documented breach response is the best defence, alongside a litigation strategy agreed early with insurers.
Enforcement, complaints and disputes
The regulator's toolkit runs from reprimands and enforcement notices to monetary penalties. In October 2025 it fined Capita £14 million after a cyber attack affecting around 6.6 million people, citing failures in privileged access controls and slow responses to security alerts. Penalties of that scale are rare, but reprimands are public and reputationally damaging. The lesson data protection solicitors London boards should take from Capita is that known, unremedied security weaknesses weigh heavily in the penalty calculation.
From 19 June 2026 every controller must have a process to handle data protection complaints, acknowledge them within 30 days and respond without undue delay. Individuals are expected to complain to the controller first, which means the controller's own records become the first line of evidence if the matter escalates.
Disputes reach the courts in several ways: compensation claims, applications to enforce subject access rights, appeals against regulator notices to the First-tier Tribunal, and judicial review. Data issues also surface inside other litigation, from employment disputes to commercial litigation over failed technology projects. Where advocacy in the higher courts is required, we instruct specialist counsel.
Some conduct is criminal. Section 170 of the DPA 2018 makes it an offence knowingly or recklessly to obtain or disclose personal data without the controller's consent, and section 173 penalises altering or concealing records to frustrate a subject access request. These provisions matter in insider-threat and departing-employee cases.
Cross-border data protection: the EU, Bangladesh, the Gulf and Asia
Many of our clients move data between the UK and other jurisdictions every day. Data protection solicitors London groups instruct should map those flows in both directions, because each jurisdiction has its own export rules.
European Union
The European Commission renewed its adequacy decisions for the UK in December 2025, with the renewed decisions due to run to December 2031 subject to review. Data can therefore flow from the EU to the UK without additional safeguards. A UK business that offers goods or services to people in the EU, or monitors their behaviour, may also be directly subject to the EU GDPR and need an EU representative.
Bangladesh
Bangladesh promulgated a Personal Data Protection Ordinance in October 2025, with some parts commencing later. UK groups with Bangladeshi subsidiaries, back offices or garment supply chains should review how employee and customer data moves between the two countries, and whether UK transfer safeguards are in place for data sent to Dhaka. Our colleagues in Bangladesh advise on the local regime, and our Bangladeshi businesses in the UK team coordinates the UK side.
The Gulf, Singapore and China
The UAE has a federal Personal Data Protection Law alongside separate regimes in the DIFC and ADGM free zones. Singapore's Personal Data Protection Act 2012 and China's Personal Information Protection Law each impose their own transfer conditions, and China in particular can require security assessments or standard contracts before data leaves the country. Where foreign law governs the outbound leg, we work with local counsel and integrate their advice into a single transfer map.
How TRW & Co helps
We act for founders, mid-market companies, regulated firms and international groups. Our work as data protection solicitors London clients rely on is practical: documents that people use, decisions that are recorded, and responses that hold up under scrutiny.
Compliance programmes
Gap analysis against the UK GDPR as amended, data mapping, records of processing, privacy notices and retention schedules. We prioritise by risk so that the board sees the material issues first.
Commercial and outsourcing contracts
Processor and data sharing agreements, SaaS and cloud terms, and international transfer documentation. We negotiate liability, audit and breach notice clauses that reflect the data actually at stake.
Breach response
Privileged incident management, reportability assessments, regulator and individual notifications, and coordination with forensic investigators and insurers. Our data breach and cyber security team works around the clock when needed.
Rights requests and complaints
Handling difficult subject access, erasure and objection requests, designing the statutory complaints process and managing escalation to the regulator.
AI and new technology
DPIAs for AI, biometrics and monitoring tools, and advice on the new automated decision-making rules. This work sits alongside our artificial intelligence practice.
Investigations and disputes
Responding to regulator information notices and investigations, defending compensation claims and challenging enforcement decisions, instructing specialist counsel for hearings where required.
We also support transactions, reviewing target companies' data practices in due diligence and drafting protections in the sale documents. To discuss a matter, contact our London office or explore all our practices.
Checklist for decision-makers
Use this list to test whether your organisation is ready for the post-2026 regime. If you cannot answer yes with evidence, speak to data protection solicitors London teams before the regulator or a claimant asks the same question.
- We have an up-to-date record of processing and know where our data is held, including in suppliers' systems.
- Each processing activity has a recorded lawful basis, and we have reviewed whether any now qualifies as a recognised legitimate interest.
- Our privacy notices reflect the February 2026 changes and are written for the people who actually read them.
- We have a written complaints procedure that acknowledges complaints within 30 days.
- Every restricted transfer has a valid mechanism and a documented risk assessment.
- Our cookie banner distinguishes exempt cookies from those that still need consent.
- Automated decisions that significantly affect people come with human review, information and a route to contest.
- We have tested our breach plan in the last year and know who decides whether to notify.
- Processor contracts give us audit rights and short breach notice periods.
- The board receives regular reporting on data risk and signs off major DPIAs.
Data protection law in England and Wales will keep moving as the regulator issues new guidance under the 2025 Act. The organisations that adapt fastest are those with clear ownership, current documents and advisers who understand both the law and the business.
Frequently asked questions
01Do we need to change our privacy notices because of the Data (Use and Access) Act 2025?
Probably, at least in part. The February 2026 changes affect lawful bases, further processing, automated decision-making and cookies, and from June 2026 individuals have a statutory right to complain to you first. Notices should explain any reliance on recognised legitimate interests, describe automated decisions and the right to human review, and tell people how to complain. Review employee and candidate notices as well as customer-facing ones, and keep a dated record of each version so you can show what people were told and when.
02How quickly must we respond to a subject access request?
You have one month from receipt, which can be extended by up to two further months if the request is complex or you have received several from the same person. You may pause the clock while you seek clarification you reasonably need, and searches need only be reasonable and proportionate. You must still tell the requester about any extension within the first month and explain why. Record each step, because the regulator will judge your response on the evidence you kept, not on your recollection.
03Do we have to report every data breach to the regulator?
No. You must report a personal data breach unless it is unlikely to result in a risk to individuals' rights and freedoms, and the report should be made without undue delay and within 72 hours where feasible. If the risk is high, you must also tell the people affected. Every breach, reportable or not, must be logged with its facts, effects and remedial action. When in doubt, take advice quickly; a late decision is harder to defend than a cautious notification.
04Can we still use analytics cookies without consent?
Possibly. Since February 2026 PECR allows certain low-risk storage and access, including some analytics used to improve a service, without consent provided users receive clear information and a simple way to object. Advertising, cross-site tracking and profiling cookies still need prior opt-in consent. Audit your cookies by purpose rather than by vendor, because the same tool can be configured in compliant and non-compliant ways, and the maximum fine for PECR breaches now matches the UK GDPR.
05Do we need a data protection officer?
Only some organisations must appoint one: public authorities, and businesses whose core activities involve regular and systematic monitoring of individuals on a large scale or large-scale processing of special category or criminal offence data. Others may appoint one voluntarily, but if you use the title the statutory duties and independence requirements apply. Many organisations instead appoint a privacy lead with clear responsibilities and board reporting, which can be equally effective if properly resourced.
06What can individuals claim if their data is misused?
Individuals can claim compensation for material damage, such as financial loss, and non-material damage, including distress, under Article 82 of the UK GDPR and section 168 of the DPA 2018. Claims are usually brought in the County Court or High Court. Representative opt-out claims are harder after Lloyd v Google, but group claims by named individuals remain common after large breaches. Insurers, regulators and claimants will all look at how quickly and transparently you responded.
07Does the UK GDPR apply to our group companies in Bangladesh or the Gulf?
It can. The UK GDPR applies to processing in the context of a UK establishment, and to non-UK businesses that offer goods or services to people in the UK or monitor their behaviour. Sending UK personal data to overseas group companies is a restricted transfer that needs a valid mechanism. Local laws, such as Bangladesh's 2025 data protection ordinance or the UAE federal law, may impose separate duties, so group policies should be checked against each regime.
Sources and official materials
- Data (Use and Access) Act 2025 — Primary legislation amending the UK GDPR, DPA 2018 and PECR
- Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 — Commencement dates of 5 February and 19 June 2026
- Data Protection Act 2018 — Exemptions, offences and enforcement framework
- Privacy and Electronic Communications (EC Directive) Regulations 2003 — Cookies and electronic marketing rules
- Information Commissioner's Office — Regulator guidance, codes and enforcement
- ICO: Report a breach — Personal data breach reporting
- ICO enforcement: Capita plc (October 2025) — £14 million penalty following a cyber attack
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.